CVE-2026-31462

drm/amdgpu: prevent immediate PASID reuse case

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pending in the IH ring buffer when the process exits and frees up its PASID. To prevent the case, it uses idr cyclic allocator same as kernel pid's.

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.16%Up 0.1 points since Apr 23, 2026

What each source reports

NVD Score used 5.5

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-05

CVE List No score

drm/amdgpu: prevent immediate PASID reuse case

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: CVE-2026-31462
Updated: 2026-11-05

EUVDEUVD-2026-24803 No score

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: EUVD-2026-24803
Updated: 2026-11-05

GitHub AdvisoriesGHSA-f9h6-fphq-w3rh 5.5

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent...

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: GHSA-f9h6-fphq-w3rh
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-31462 5.5

Record: BELL-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-04

OSVDEBIAN-CVE-2026-31462 5.5

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: prevent immediate PASID reuse case PASID resue could cause interrupt issue when process immediately runs into hw state left by previous process exited with the same PASID, it's possible that page faults are still pending in the IH ring buffer when the process exits and frees up its PASID. To prevent the case, it uses idr cyclic allocator same as kernel pid's. (cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: DEBIAN-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

Show 23 moreShow less

OSVOESA-2026-3317 9.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)(CVE-2026-31462)

In the Linux kernel, the following vulnerability has been resolved:

media: hackrf: fix to not free memory after the device is registered in hackrf_probe()

In hackrf driver, the following race condition occurs:

		CPU0						CPU1
hackrf_probe()
  kzalloc(); // alloc hackrf_dev
  ....
  v4l2_device_register();
  ....
						fd = sys_open(&quot;/path/to/dev&quot;); // open hackrf fd
						....
  v4l2_device_unregister();
  ....
  kfree(); // free hackrf_dev
  ....
						sys_ioctl(fd, ...);
						  v4l2_ioctl();
						    video_is_registered() // UAF!!
						....
						sys_close(fd);
						  v4l2_release() // UAF!!
						    hackrf_video_release()
						      kfree(); // DFB!!

When a V4L2 or video device is unregistered, the device node is removed so new open() calls are blocked.

However, file descriptors that are already open-and any in-flight I/O-do not terminate immediately; they remain valid until the last reference is dropped and the driver's release() is invoked.

Therefore, freeing device memory on the error path after hackrf_probe() has registered dev it will lead to a race to use-after-free vuln, since those already-open handles haven't been released yet.

And since release() free memory too, race to use-after-free and double-free vuln occur.

To prevent this, if device is registered from probe(), it should be modified to free memory only through release() rather than calling kfree() directly.(CVE-2026-31576)

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC.

If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault.

Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.(CVE-2026-31577)

In the Linux kernel, the following vulnerability has been resolved:

media: as102: fix to not free memory after the device is registered in as102_usb_probe()

In as102_usb driver, the following race condition occurs:

		CPU0						CPU1
as102_usb_probe()
  kzalloc(); // alloc as102_dev_t
  ....
  usb_register_dev();
						fd = sys_open(&quot;/path/to/dev&quot;); // open as102 fd
						....
  usb_deregister_dev();
  ....
  kfree(); // free as102_dev_t
  ....
						sys_close(fd);
						  as102_release() // UAF!!
						    as102_usb_release()
						      kfree(); // DFB!!

When a USB character device registered with usb_register_dev() is later unregistered (via usb_deregister_dev() or disconnect), the device node is removed so new open() calls fail. However, file descriptors that are already open do not go away immediately: they remain valid until the last reference is dropped and the driver's .release() is invoked.

In as102, as102_usb_probe() calls usb_register_dev() and then, on an error path, does usb_deregister_dev() and frees as102_dev_t right away. If userspace raced a successful open() before the deregistration, that open…

Record: OESA-2026-3317
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2026-31462 5.5

CVE-2026-31462 in linux - Patched by Root

Root has patched CVE-2026-31462 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2026-31462 5.5

CVE-2026-31462 in linux - Patched by Root

Root has patched CVE-2026-31462 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-13-CVE-2026-31462 5.5

CVE-2026-31462 in linux - Patched by Root

Root has patched CVE-2026-31462 in the linux package for Root:Debian:13. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-13-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSVROOT-OS-UBUNTU-2204-CVE-2026-31462 5.5

CVE-2026-31462 in linux - Patched by Root

Root has patched CVE-2026-31462 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2026-31462 5.5

CVE-2026-31462 in linux - Patched by Root

Root has patched CVE-2026-31462 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2026-31462
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2026-31462 2.0

Record: UBUNTU-CVE-2026-31462
CVSS 4.0: 2.0 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-06

OSVAZL-83234 No score

CVE-2026-31462 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: AZL-83234
Updated: 2026-11-05

OSVCLSA-2026-1780562693 No score

kernel: Fix of 111 CVEs

fbcon: Fix OOB access in font allocation {CVE-2025-39967}
fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273}
macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475}
unshare: fix unshare_fs() handling {CVE-2026-43472}
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
cgroup: fix race between task migration and iteration {CVE-2026-43439}
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
nvmet: fix memory leak of bio integrity {CVE-2025-38405}
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400}
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015}
bonding: check xdp prog when set bond mode {CVE-2025-22105}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411}
RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
dm: remove fake timeout to avoid leak request {CVE-2026-43314}
drm: Account property blob allocations to memcg {CVE-2026-43287}
HID:…

Record: CLSA-2026-1780562693
Updated: 2026-11-02

OSV No score

drm/amdgpu: prevent immediate PASID reuse case

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: prevent immediate PASID reuse case

(cherry picked from commit 8f1de51f49be692de137c8525106e0fce2d1912d)

Record: CVE-2026-31462
Updated: 2026-11-07

OSVopenSUSE-SU-2026:21555-1 No score